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A  Review  of  Computer  Evacuation  Models 
and  Their  Data  Needs 


Introduction 

The  situation  found  in  passenger  carrying  aircraft 
may  be  a  fire  safety  official’s  “worst  nightmare.” 
Potentially  hundreds  of  passengers  are  closely  seated 
in  a  long,  narrow  aluminum  tube,  surrounded  by  tens 
of  thousands  of  gallons  of  highly  flammable  jet  fuel. 
Should  a  fire  begin  as  a  result  of  some  mishap,  it  is 
essential  that  all  of  these  people  evacuate  the  aircraft 
in  the  shortest  possible  time.  Indeed,  in  most  major 
aircraft  accidents,  all  of  the  cabin  occupants  are  alive 
at  the  moment  that  the  airplane  stops,  but  perish 
while  trying  to  escape  from  the  fire  that  follows.  To 
ensure  that  passengers  will  survive  an  aircraft  acci¬ 
dent,  the  Federal  Aviation  Administration  (FAA)  re¬ 
quires  manufacturers  and  operators  of  airliners  to 
meet  a  number  of  design  and  performance  standards 
related  to  cabin  evacuation.  Among  the  most  contro¬ 
versial  of  these  regulations  is  what  is  commonly  called 
The  90  Second  Rule  (23).  This  regulation  requires 
that  a  manufacturer  demonstrate  that  an  aircraft  cabin 
can  be  safely  evacuated  in  less  than  90  seconds  with 
half  of  the  usable  exits  blocked,  in  darkness,  and  with 
a  defined  mix  of  gender  and  age  among  the  simulated 
passengers.  These  demonstration  tests  are  expensive 
to  run,  and  are  ethically  questionable  because  of  the 
very  real  possibility  of  some  of  the  test  subjects  being 
injured  in  a  test. 

Given  that  safe  evacuation  is  so  critical  to  surviving 
an  aircraft  accident,  and  that  showing  compliance 
with  the  90  second  rule  can  be  so  burdensome,  a 
computer  simulation  of  the  evacuation  of  an  aircraft 
cabin  is  needed.  A  proven,  validated  computerized 
simulation  tool  could  address  several  needs.  As  an 
accident  reconstruction  tool,  such  a  simulation  can 
provide  insight  into  why  some  passengers  perish  while 
others  survive,  and  how  the  design  of  the  cabin  might 
be  modified  to  improve  survivability.  Aircraft  design¬ 
ers  would  have  a  tool  to  make  evacuation  issues  a 
consideration  early  in  the  design  cycle  — when  changes 
are  easily  made.  The  FAA  would  have  a  tool  available 
to  assist  in  analyzing  evacuation  issues  that  confront 
the  Agency. 


Modeling  Fundamental* 

Evacuation  models  tend  to  be  of  two  categories, 
network  models,  and  queuing  models  (1).  Virtually 
all  models  of  aircraft  evacuation  are  queuing  models, 
as  are  many  building  evacuation  models.  Network 
models  have  been  used  to  simulate  building  evacua¬ 
tions  (1),  a  prominent  example  being  EVACNET+, 
developed  by  the  National  Institute  for  Standards  and 
Testing  (NIST,  formerly  the  Bureau  of  Standards). 
Network  models  develop  paths  between  people  and 
exits,  and  then  use  graph  theory  and  combinatorial 
analysis  to  simulate  the  resulting  evacuation.  For  a 
variety  of  reasons,  aircraft  evacuation  simulations 
have  been  queuing  models,  rather  than  network  mod¬ 
els. 

Whenever  the  current  demand  for  a  service  (such  as 
exiting  an  aircraft)  exceeds  the  current  capacity  to 
provide  a  service,  a  queue  (i.e.,  a  line)  results(l). 
Queuing  theory  is  the  body  of  knowledge  that  de¬ 
scribes  the  dynamics  of  waiting  lines.  Mathematically, 
a  queuing  situation  is  a  stochastic  process  in  that  it 
develops  over  time,  and  obeys  the  laws  of  probability. 
Thus,  cabin  evacuation  models  may  be  considered  to 
be  simulations  of  the  formation  and  processing  of 
lines  at  aircraft  exits  during  emergencies. 

Because  queuing  is  a  stochastic  process,  it  is  neces¬ 
sary  to  introduce  a  randomizer  into  the  simulation. 
Common,  non-computer  related  randomizers  include 
items  such  as  the  throw  of  dice,  or  a  deck  of  playing 
cards.  With  computers,  mathematical  routines  gener¬ 
ate  a  series  of  random  numbers  that  are  then  used  in 
decisions  in  the  simulation.  For  example,  assume  that 
there  is  a  70%  chance  of  moving  from  one  section  of 
an  aircraft  cabin  to  another.  A  random  number  be¬ 
tween  0  and  1  is  generated,  and  if  that  number  is  less 
than  or  equal  to  0.7,  then  the  simulated  passenger 
moves.  If  the  number  is  greater  than  0.7,  the  simu¬ 
lated  passenger  does  not  move.  Random  number 
generators  may  have  different  probability  distribu¬ 
tions,  but  for  evacuation  models  usually  generate  a 
uniform  distribution.  Random  number  generators 
typically  need  a  starting  value  to  calculate  the  random 


1 


Uist 


bpecia! 


scries.  This  starting  value  is  referred  to  as  the  seed.  An 
identical  series  of  random  numbers  is  generated  if  the 
same  seed  is  used.  Some  simulations  allow  the  user  to 
specify  a  seed,  or  the  user  can  specify  that  the  simula¬ 
tion  generates  a  random  starting  value.  A  frequent 
source  for  a  random  starting  value  is  the  current  date 
and  time  as  read  from  the  computer’s  clock.  If  differ¬ 
ent  seeds  are  used,  differing  results  of  a  simulation 
might  be  expected,  and  most  aircraft  cabin  evacuation 
simulations  allow  the  user  to  run  a  series  of  simula¬ 
tions  with  identical  configurations,  but  using  differ¬ 
ent  seeds.  The  mean  value  of  the  results  of  these 
simulations  is  then  studied. 

We  have  defined  a  stochastic  process  as  an  event 
occurring  over  time  and  following  the  laws  of  prob¬ 
ability.  The  use  of  random  number  generators  allows 
a  mechanism  for  introducing  the  laws  of  probability, 
but  a  means  of  simulating  the  element  of  time  is  also 
necessary.  This  factor  is  introduced  through  a  simula¬ 
tion  clock  that  begins  counting  at  time  0  in  a  simula¬ 
tion,  and  continues  until  the  simulation  is  completed. 
Each  fraction  of  a  second  that  1  cycle  of  the  simulation 
clock  represents  is  referred  to  as  1  clock  tick.  Put  too 
few  clock  ticks  into  a  second,  and  you  miss  important 
details,  resulting  in  the  model  being  unable  to  accu¬ 
rately  simulate  the  situation.  Put  too  many  clock  ticks 
In,  and  the  computational  load  (i.e.,  speed  with  which 
the  simulation  runs;  size  and  expense  of  the  necessary 
computer)  increases  without  any  added  realism.  Con¬ 
sider  two  extreme  cases.  If  one  clock  tick  is  90  seconds, 
you  go  from  everyone  seated  to  an  empty  aircraft 
without  understanding  the  dynamics  in  between.  If 
one  clock  tick  is  1  millisecond  (one  thousandth  of  a 
second),  you  have  to  do  90,000  cycles  for  a  90  second 
simulation,  yet,  the  difference  in  movement  in  1 
millisecond  is,  at  best,  undetectable.  Selection  of  an 
appropriate  clock  speed  is  part  of  the  “art”  of  com¬ 
puter  modeling. 

A  typical  aircraft  evacuation  model  is  a  stochastic 
queuing  model.  Each  passenger  is  represented  and 
governed  by  a  set  of  rules  for  their  behavior  that  relate 
a  probability  generated  by  a  random  number  genera¬ 
tor  to  some  probability  of  taking  an  action.  A  simula¬ 
tion  clock  runs  the  model.  At  each  clock  tick,  the 
actions  of  each  passenger  are  determined,  based  on  the 
rules  governing  behavior,  the  probabilities  generated 
by  the  random  number  generator,  and  the  environ¬ 


ment  in  which  the  passenger  is  located  (e.g.,  locations 
and  actions  of  other  adjacent  simulated  passengers, 
presence  of  combustion  toxins  in  the  air,  proximity 
and  paths  to  exits,  and  whether  blockages  exist  in  the 
aisle).  After  each  clock  tick,  passengers  are  moved  to 
their  new  location,  the  cabin  environment  is  updated, 
and  the  process  is  repeated  until  either  everyone  is 
evacuated  or  dead,  or  the  simulation  is  stopped  by  the 
user. 

Historical  Development 

The  potential  for  a  fire  in  a  building  also  poses 
evacuation  questions.  Virtually  every  local  govern¬ 
ment  has  an  extensive  set  of  building  codes  designed 
to  reduce  or  eliminate  both  the  possibility  of  a  fire, 
and  the  risk  of  death  and  injury  to  people  who  might 
be  in  a  building  that  catches  fire.  A  primary  consider¬ 
ation  in  these  regulations  is  the  safe  evacuation  of  the 
building,  leading  to  regulations  concerning,  the  num¬ 
ber,  size,  marking,  and  distribution  of  exits,  and  the 
maximum  number  of  people  who  can  safely  occupy  a 
room.  Building  designers  have  also  been  interested  in 
computerized  simulations  of  the  evacuation  process, 
for  reasons  similar  to  those  of  aircraft  designers.  This 
paper  will  not  review  computer  simulations  of  the 
evacuation  of  a  burning  building,  though  the  inter¬ 
ested  reader  is  referred  to  Watts  (1). 

One  of  the  first  efforts  at  computer  modeling  of  an 
evacuating  aircraft  was  pursued  by  the  Civil  Aero- 
medical  Institute  (CAMI)  in  the  1970s  (2,3).  These 
simulations  depended  on  a  special  computer  language 
developed  by  IBM  called  GPSS  (General  Purpose 
Simulation  System),  and  required  large  mainframe 
computers  to  run.  The  simulations  considered  a  num¬ 
ber  of  features,  such  as  passenger  mix,  seating  and  exit 
configuration,  door  opening  delay,  time  on  an  escape 
slide,  and  slide  capacity.  The  simulations  were  in¬ 
tended  for  study  of  certification  tests,  and  not  neces¬ 
sarily  for  accident  reconstruction.  As  a  result,  the 
models  did  not  simulate  life-threatening  factors,  such 
as  toxic  combustion  gas  products,  nor  did  they  con¬ 
sider  passenger  behavior  in  a  life-threatening  situa¬ 
tion.  The  model  was  used  to  simulate  narrow-body, 
single-aisle  aircraft  (Boeing  720  in  124-and  234- 
passenger  configurations),  and  wide-body,  dual-aisle, 
aircraft  (B-747,  DC-10,  and  L-1011). 


2 


Type  of 
Aircraft 


Passenger 

Load 


Certification 
Time  (sec) 


Average 
Simulated 
Time  (sec) 


Redirection 


B-747 

527 

66.2 

84.0 

Yes 

L-1011 

356 

101.1 

93.5 

No 

L-1011 

356 

82.0 

84.9 

Yes 

L-1011 

411 

89.7 

79.6 

Yes 

TABLE  1  —  Comparison  of  Simulation  and  Certification  Evacuation  Times 

(Garner,  Chandler,  and  Cook,  1978) 


Tabic  1  compares  the  evacuation  times  from  certi¬ 
fication  trials  and  from  the  simulations  conducted. 
Note  the  counter-intuitive  result,  found  in  both  the 
simulation  and  the  certification  tests,  of  an  L- 1011 
with  a  higher  passenger  load  recording  a  faster  evacu¬ 
ation  time  compared  to  an  L- 1011  with  a  lower 
passenger  load.  A  further  difference  between  these 
two  tests  is  that  the  356-passenger  model  used  three 
Type  A,  and  one  Type  I  exits,  while  the  41 1 -passenger 
model  used  four  Type  A  exits.  The  last  column, 
labeled  Redirection,  refers  to  a  feature  of  the  tests.  If 
passengers  are  instructed  to  use  a  particular  exit  re¬ 
gardless  of  the  queue,  redirection  is  “No.”  If  passen¬ 
gers  may  change  the  exit  they  use  in  an  attempt  to  find 
the  shortest  line/fastest  exit,  then  redirection  is  “Yes.” 

Some  of  the  potential  for  computerized  simulation 
of  evacuation  is  revealed  in  Table  1.  Note  that  with 
the  L- 1011  simulations,  potential  design  changes 
(Type  A  versus  Type  I  exits)  were  analyzed,  as  well  as 
differing  passenger  loads. 

Examination  of  Table  1  shows  that  the  simulations 
both  under-  and  over-predicted  the  times  from  the 
evacuation  trials  though  the  simulated  times  are  com¬ 
parable  to  the  certification  times.  It  should  be  noted 
that  the  certification  trials  represent  a  single  test, 
while  the  simulations  represent  averages  of  as  many  as 
20  repeats.  It  is  unlikely  that  if  a  certification  test  were 
repeated  the  same  evacuation  time  would  be  found 
again,  and  with  only  a  single  test  the  variation  and 
standard  deviation  of  these  times  are  indeterminate. 


Garner,  et.  al.,  (3)  concluded  that  their  model  could 
closely  simulate  actual  evacuation  times,  and  recom¬ 
mended  that  additional  research  be  done  to  refine  the 
inputs  needed  by  their  model. 

This  early  work  showed  the  potential  of  evacuation 
models,  as  well  as  revealed  the  limitations.  There  was 
very  little  research  on  which  to  base  the  modeling 
parameters  needed,  and  yet  this  was  identified  by  the 
study’s  authors  as  critically  needed  information.  In 
addition,  using  the  models  required  large  mainframe 
computers,  the  situations  studied  were  not  easily 
changed  without  rewriting  a  GPSS  program  (and 
GPSS  is  not  a  widely  known  computer  language),  and 
the  results  of  the  simulations  tended  to  be  large 
printouts  with  many  numbers,  thus,  not  easily  under¬ 
stood. 

Review  of  Current  Models 

Today  there  are  three  different  cabin  evacuation 
models  in  development  and  use.  These  models,  to  be 
described  in  detail,  are  the  Gourary  Associates  (GA) 
Model,  developed  by  Barry  Gourary  under  FAA  spon- 
sorship(4);  AIREVAC,  developed  by  James  Schroeder 
under  Air  T  ransport  Association  of  America  sponsor¬ 
ship^);  and  EXODUS  (6),  developed  in  England  by 
Ed  Galea.  In  the  following  discussion  it  is  important 
to  examine  the  guidance  given  to  the  model’s  devel¬ 
oper  when  considering  limitations  of  a  model.  Given 
enough  time  and  money,  virtually  any  model  can  be 
modified  to  add  any  capabilities  that  it  lacks.  In  a 
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world  of  finite  time  and  financial  resources,  the  model’s 
developer  has  made  choices  based  on  sponsor  guid¬ 
ance,  which  result  in  the  simulation’s  limitations. 

GA  Model 

After  the  early  modeling  work  at  CAMI  (2,3)  an 
effort  was  initiated  to  build  on  the  strengths,  and 
correct  some  of  the  weaknesses  identified  in  the  pre¬ 
vious  effort.  In  1987,  Barry  Gourary  of  Gourary 
Associates  (GA)  developed  a  new  cabin  evacuation 
model  under  Federal  Aviation  Administration  (FAA) 
sponsorship  (4).  Guidance  given  to  GA  included  that 
the  model  should  run  on  then  state-of-the-art  per¬ 
sonal  computers,  produce  a  graphical  display  of  the 
results,  run  in  near  real  time,  and  be  flexible  in  terms 
of  cabin  arrangements  and  passenger  characteristics 
without  requiring  a  programmer  to  rewrite  the  simu¬ 
lation  each  time.  Further,  the  sponsorship  of  this 
model  development  occurred  under  a  government 
program  known  as  the  Small  Business  Innovative 
Research  (SBIR)  program.  Central  to  the  SBIR  pro¬ 
gram  is  a  requirement  that  the  project  produce  a 
commercially  viable  product,  in  this  case,  a  computer 
program  that  could  be  sold  to  interested  users.  Note 
that  in  1987  a  state-of-the-art  personal  computer  was 
based  on  an  Intel  80286  processor,  a  now  outdated 
technology.  The  resulting  model  was  used  to  recon¬ 
struct  three  actual  aircraft  accidents.  A  number  of 
improvements  were  made  after  the  initial  released, 
with  the  most  recent  having  been  completed  in  late 
1992  (4). 

The  GA  model  divides  an  aircraft  cabin  into  a  series 
of  cells.  Each  cell  is  the  length  of  one  row,  and  the 
width  of  one  seat  and/or  aisle.  Each  passenger  is 
described  by  a  number  of  parameters,  such  as  their 
endurance  ot  agility,  and  each  passenger  is  assigned  an 
exit  to  use.  A  cell  may  be  occupied  by  at  most  2 
passengers,  and  with  each  tick  of  the  simulation  clock 
(3  ticks  per  simulated  second)  the  passengers  attempt 
to  move  to  their  assigned  exit.  Each  passenger  has  a 
defined  probability  of  moving  from  one  cell  to  the 
next,  and  this  probability  is  a  function  of  their  endur¬ 
ance,  agility,  and  surroundings.  In  contrast  to  most 
other  evacuation  models,  in  the  GA  Model  the  speed 
at  which  passengers  move  is  not  a  user-defined  param¬ 
eter,  but  is  specified  by  the  probability  of  moving 


from  one  cell  to  the  next.  Thus,  a  faster  passenger  has 
a  higher  probability  of  movement  compared  to  a 
slower  passenger.  The  movement  probability  is  influ¬ 
enced  by  a  factor  that  reduces  the  passenger’s  endur¬ 
ance  (i.e.,  ability  to  live  and  move)  with  each  tick  of 
the  clock.  When  the  passenger’s  endurance  drops 
below  a  threshold  value,  that  passenger  is  considered 
a  fatality.  As  the  simulation  runs,  the  user  may  specify 
that  passengers  are  no  longer  required  to  use  their 
assigned  exit,  rather,  the  passenger  will  use  the  closest 
available  exit.  It  is  also  possible  to  simulate  a  flight 
attendant  at  an  exit,  thus,  increasing  the  probability  of 
someone  successfully  exiting  during  a  clock  tick.  Only 
one  exit  in  the  aircraft  at  a  time  may  have  a  simulated 
flight  attendant  stationed  at  that  exit,  though  Gourary 
has  suggested  techniques  to  simulate  flight  attendants 
being  stationed  at  several  exits  during  a  single  clock 
tick  (24). 

The  program  produces  a  graphical  display  showing 
an  overhead  view  of  the  seats,  rows,  exits,  and  occu¬ 
pants.  Color  coding  differentiates  dead  passengers 
from  those  still  capable  of  escaping.  Without  any 
specialized  computer  knowledge,  the  user  may  set 
characteristics  of  the  cabin  and  passengers.  The  num¬ 
ber  of  exits  is  fixed  at  4  overwing  exits,  and  main  exit 
passageways  at  the  front  and  rear  of  the  cabin.  How¬ 
ever,  fewer  exits  may  be  simulated  by  specifying  an 
infinite  time  to  open  an  exit.  Only  a  single-aisle 
aircraft  with  at  most  3  seats  per  row  on  each  side  of  the 
aircraft  may  be  simulated,  i.e.,  wide-body,  dual-aisle 
aircraft  cannot  be  studied. 

A  user  of  the  GA  Model  does  not  require  any 
specialized  computer  knowledge,  such  knowledge  of  a 
programming  language.  Input  to  the  program  is  per¬ 
formed  with  editors  supplied  with  the  model.  The 
input  files  are  stored  in  a  non-standard  file  format, 
and  only  the  editors  supplied  with  the  program  can  be 
used  to  enter  and  modify  data.  The  software  was 
written  in  MS  Basic  (24),  though  the  source  code  for 
the  program  is  not  available.  Options  in  terms  of 
specifying  printers,  video  drivers,  etc.,  are,  at  best, 
limited. 

The  model  includes  a  crude  toxic  environment 
simulation  to  represent  the  influence  of  combustion 
products  from  a  fire.  The  user  may  specify  a  maximum 
of  two  zones  with  harmful  fire  and  smoke  environ- 
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ments  within  the  cabin.  For  each  zone,  at  some  user 
defined  time  in  the  simulation,  the  environment  in 
each  zone  goes  from  completely  non-toxic,  to  some 
degree  of  life  impairing.  The  toxicity  of  the  cabin 
environment  is  different  in  each  zone,  however,  the 
life  impairment  function  cannot  be  based  on  a  func¬ 
tion  of  time,  and  there  is  no  transition  between  zones. 
The  toxicity  of  the  environment  is  specified  by  a 
numeric  value.  This  value  is  an  additional  decrement 
per  simulation  clock  tick  in  each  passenger’s  endur¬ 
ance.  Little  guidance  is  available  for  determining 
these  values. 

When  the  program  was  originally  developed,  prob¬ 
lems  were  noted  with  blocked  passenger  flows.  Two 
situations  in  which  this  occurred  were  when  a  cell  on 
the  path  to  an  exit  was  blocked  by  two  fatalities,  and 
when  two  groups  of  passengers  going  in  opposite 
directions  (e.g.,  one  group  headed  for  the  forward 
exit,  the  second  group  headed  for  the  rear  exit)  met  at 
the  same  cell.  In  the  situation  with  two  fatalities  in  a 
cell,  it  was  no  longer  possible  for  other  surviving 
passengers  to  pass  through.  While  this  is  not  an 
impossible  situation,  there  is  a  distinct  possibility  that 
in  a  real  situation,  a  still  surviving  passenger  seeking  to 
exit  would  get  around  the  fatalities  blocking  the  path. 
Since  the  original  release,  the  GA  model  has  been 
modified  to  simulate  the  possibility  of  passage,  albeit 
with  a  reduced  probability  (implying  a  slower  speed) 
through  a  blocked  cell.  The  problem  with  opposed 
flows  would  result  in  the  flow  halting  while  each  side 
tried  to  pass  the  other.  While  the  question  of  what 
would  happen  in  a  real  situation  is  unresolved  (would 
not  people  in  one  of  the  two  flows  think  that  the  other 
people  knew  where  they  were  going?),  the  program 
has  been  modified  to  introduce  a  probability  to  each 
flow  of  passing  the  other. 

As  examples  and  validation  of  the  GA  Model, 
Gourary  reconstructed  three  accidents,  and  modeled 
the  aircraft  used  in  some  of  these  accidents  in  simu¬ 
lated  certification  tests  (i.e.,  without  the  environmen¬ 
tal  toxins  being  turned  on)(4).  The  three  accidents 
reconstructed  were  1)  United  DC-8  with  1 14  passen¬ 
gers,  Denver,  Colorado,  July  1961;  2)  United  B-727, 
Salt  Lake  City,  November  1965  with  85  passengers  on 
board;  3)  Texas  International  DC-9,  Denver,  Colo¬ 
rado,  November  1976  with  81  passengers.  The  first 


two  accidents  were  simulated  because  exquisitely  de¬ 
tailed  accident  investigations  were  available  in  (8). 
The  third  case  was  selected  as  being  an  example  of 
where  the  GA  Model  could  be  applied.  In  performing 
these  simulations  Gourary  (4)  noted  the  limitations  of 
the  data  upon  which  to  base  modeling  parameters, 
and  in  the  case  of  the  Texas  International  DC-9,  the 
lack  of  information  from  the  accident  investigation. 

AIREVAC  Model 

AIREVAC  was  developed  by  James  Schroeder,  origi¬ 
nally  of  the  Southwest  Research  Institute,  under  spon¬ 
sorship  of  the  Air  Transport  Association  (ATA)  of 
America  (5,  17).  AIREVAC  was  developed  to  simu¬ 
late  a  certification  test,  and  not  for  accident  recon¬ 
struction.  In  particular,  AIREVAC  was  developed  to 
study  the  impact  on  aircraft  emergency  cabin  evacua¬ 
tions  of  transporting  disabled  passengers.  While  this 
was  the  immediate  goal,  Schroeder  sought  to  develop 
a  model  with  potentially  wider  applications. 

Within  the  guidelines  provided  by  ATA,  Schroeder 
developed  a  model  of  a  certification  evacuation  test 
(i.e.,  no  simulated  fire  or  other  environmental  as¬ 
saults)  of  a  B-727-200  aircraft.  The  model  can  simu¬ 
late  any  number  of  passengers  up  to  the  capacity  of  the 
plane,  but  cannot  be  used  without  reprogramming  to 
simulate  any  other  type  of  aircraft,  either  a  wide-body, 
dual-aisle  or  a  narrow-body,  single-aisle  aircraft  other 
than  a  B-727.  However,  the  model  can  be  repro¬ 
grammed  to  simulate  other  types  and  configurations 
of  aircraft,  though  this  requires  a  user  knowledgeable 
of  Simscript,  the  computer  language  used  by 
AIREVAC. 

Simscript  is  a  specialized,  relatively  unknown  com¬ 
puter  language  used  for  simulating  systems.  AIREVAC 
was  developed  and  runs  on  a  SUN  Workstation, 
though  work  is  in  progress  to  port  it  to  an  Intel  80x86- 
based  machine.  The  program  runs  much  more  slowly 
than  real  time,  and  to  simulate  90  seconds  of  an 
evacuation  of  a  full  plane  takes  several  hours.  The 
smaller  the  passenger  load,  the  faster  the  simulation 
runs.  The  simulation  clock  runs  at  5  ticks  per  second. 

Schroeder’s  model  uses  many  of  the  parameters 
commonly  required  by  an  evacuation  model,  such  as 
number  of  passengers,  their  location,  and  their  speed 
of  movement.  However,  AIREVAC  features  a  dc- 
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tailed  set  of  psycho-social  parameters  describing 
someone’s  reaction  to  being  in  an  evacuation.  A  pas¬ 
senger  is  described  by  specifying  these  characteristics 
(e.g.,  frustration  index,  dominance/submission,  knowl¬ 
edge  of  aircraft  exits  and  routes).  The  number  of 
parameters,  and  their  associated  values  represent  a 
prohibitive  impediment  to  creating  a  data  set  describ¬ 
ing  all  of  the  individuals  on  a  full  plane.  To  solve  this 
problem,  Schroeder  derived  mean  values,  and  the 
distribution  around  these  mean  values  for  each  pa¬ 
rameter  needed.  AIREVAC  features  a  randomizer 
that  creates  as  many  passengers  as  needed  for  a  simu¬ 
lation,  with  each  passenger  representing  a  unique, 
random  collection  of  the  required  parameters.  While 
a  user  can  specify  any  of  the  values,  the  more  common 
situation  would  be  to  depend  on  the  randomizer.  In 
this  manner,  the  program  creates  a  representative 
sample  of  the  American  population. 

The  initial  goal  of  the  AIREVAC  was  to  simulate  a 
certification  test.  As  a  result,  the  model  lacks  capabili¬ 
ties  needed  for  accident  reconstruction,  such  as  simu¬ 
lation  of  the  debilitating  influence  of  toxic  smoke.  In 
addition  to  the  physiological  debilitation,  a  model 
such  as  AIREVAC  with  detailed  psycho-social  simu¬ 
lation  capability,  needs  additional  parameters  to  de¬ 
scribe  someone’s  reaction  to  an  emergency.  For 
example,  parameters  describing  someone’s  panic  be¬ 
havior,  bonding  of  families,  etc.,  have  been  suggested 
as  being  important  in  an  emergency,  and  not  necessar¬ 
ily  important  in  a  certification  test.  Thus,  for 
AIREVAC  to  perform  accident  reconstruction  it  not 
only  needs  a  means  to  simulate  the  toxic  environment 
found  in  an  accident,  but  also  to  simulate  people’s 
behavior  in  that  situation. 

EXODUS 

EXODUS  was  developed  in  conjunction  with  com¬ 
putational  fire  dynamics  (CFD)  modeling  research 
conducted  at  the  University  of  Greenwich  in  En¬ 
gland.  CFD  attempts  to  simulate  the  growth  and 
spread  of  a  fire,  and  to  predict  the  combustion  prod¬ 
ucts  and  temperatures  that  result  from  a  fire.  In 
conjunction  with  this  research,  Ed  Galea  developed 
EXODUS  (6)  to  simulate  emergency  evacuation  of  an 
aircraft.  Galea  has  proposed  and  used  EXODUS  to 
simulate  evacuations  in  other  situations  that  find  large 


numbers  of  people  in  an  enclosed  space,  in  close 
proximity  to  each  other,  with  a  limited  number  of 
exits,  and  exposed  to  a  fire.  In  lddition  to  aircraft,  the 
model  has  been  and/or  can  be  used  to  simulate  evacu¬ 
ation  from  trains,  theaters,  cinemas,  and  lecture  halls. 
EXODUS  is  a  separate  program  from  the  CFD  model, 
but  it  can  accept  information  calculated  by  a  CFD 
model  about  the  cabin  environment.  EXODUS  can 
also  accept  information  empirical  data  collected  from 
fire  tests.  Because  EXODUS  can  accept  detailed  cabin 
environmental  data  it  has  the  ability  to  perform  acci¬ 
dent  reconstructions  that  feature  sophisticated  simu¬ 
lation  of  the  generation  and  absorption  of  toxic 
environmental  elements  from  the  fire  (such  as  carbon 
monoxide,  hydrogen  cyanide,  heat,  etc.).  EXODUS 
has  been  used  to  simulate  both  wide-body,  dual-aisle 
and  narrow-body,  single-aisle  aircraft.  The  simula¬ 
tion  can  be  used  for  certification  tests  and  for  accident 
reconstructions. 

EXODUS  is  an  expert  system-based  simulation, 
and  was  developed  in  a  software  environment  devel¬ 
oped  by  G2(7).  To  run  G2,  and  by  extension  EXO¬ 
DUS,  requires  a  SUN  SPARC- 1  workstation,  though 
work  is  in  progress  to  place  EXODUS  onto  an  INTEL 
80486  based  or  better  platform.  While  EXODUS  in 
conjunction  with  a  CFD  simulation  is  very  detailed, 
it  requires  a  level  of  computer  knowledge,  and  a 
sufficiently  powerful  computer  that  puts  it  out  of  the 
reach  of  all  but  the  most  sophisticated  users.  How¬ 
ever,  by  itself,  with  data  from  a  previously  run  CFD 
model  or  an  experiment,  EXODUS  runs  in  a  few 
minutes. 

EXODUS  features  an  extensive  graphical  display 
of  the  simulation’s  progress  and  results,  detailed  in¬ 
formation  on  how  much  of  the  environmental  toxins 
were  absorbed  by  each  passenger  during  the  test,  and 
the  time  for  each  passenger  to  exit  the  aircraft,  or  until 
their  death.  EXODUS  is  composed  of  five  interacting 
components  which  together  describe  the  evacuation 
process  of  a  cabin.  These  five  components  are: 

Movement  model  controls  the  physical  move¬ 
ment  of  individual  passengers,  or  supervises  the 

waiting  period  if  movement  is  not  possible. 
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Behavior  model  determines  an  individual’s  re¬ 
sponse  to  the  current  situation  based  on  that 
passenger’s  personal  attributes,  and  then  passes  the 
decision  to  the  movement  model.  In  the  current 
implementation,  all  passengers  head  for  the  near¬ 
est  serviceable  or  assigned  exit. 

Passenger  model  describes  an  individual  in  terms 
of  22  attributes  and  variables  such  as  name,  gen¬ 
der,  age,  movement  speed,  dead/alive,  etc.  Some 
attributes  are  fixed  and  unchanging,  while  others 
change  in  response  to  information  from  other  sub 
models. 

Hazard  model  describes  the  atmospheric  and 
physical  environment.  It  controls  fire  hazards  such 
as  heat,  and  combustion  product  toxins,  as  well  as 
the  opening  and  closing  of  exits. 

Toxicity  model  determines  the  effects  on  an  indi¬ 
vidual  exposed  to  the  toxins  calculated  and  distrib¬ 
uted  by  the  hazard  model.  The  toxicity  model 
communicates  with  the  behavior  model,  and  in 
turn  the  movement  model,  to  simulate  the  re¬ 
duced  ability  to  escape  the  cabin  fire  as  it  progresses. 

EXODUS  has  been  demonstrated  in  a  hypothetical 
wide-body,  dual-aisle  aircraft  under  both  simulated 
fire,  and  certification  demonstration  types  of  tests(6). 
The  model  has  also  been  used  to  reconstruct  the 
British  Airtours  B-737  aborted  takeoff  and  fire  at 
Manchester  Airport  in  1985  (9). 

To  demonstrate  the  validity  of  EXODUS,  Galea 
(6)  simulated  a  series  of  controlled  evacuation  tests 
from  a  Trident  Three  aircraft  conducted  by  Helen 
Muir  at  the  Cranfield  Institute  of  Technology  (10). 
Muir  conducted  both  orderly  evacuations,  and  used  a 
unique  financial  incentive  to  simulate  panic  among 
passengers.  Galea  simulated  both  orderly  runs,  and  in 
some  simulations,  allowed  the  simulated  passengers 
to  climb  over  seat  backs  in  an  attempt  to  exit  more 
quickly.  Galea’s  modeling  parameters  were  based  on 
his  initial  “guesses’’  of  the*  parameters  needed,  yet 
predicted  similar  trends  to  those  found  by  Muir. 
While  the  trends  predicted  by  the  simulation  matched 
those  found  in  the  tests,  the  model  predicted  that  the 
cabin  would  be  evacuated  in  less  time  than  recorded  in 
the  tests  (i.e.,  the  model  predicts  a  faster  evacuation  than 
experienced).  These  results  must  be  considered  within 
the  context  that  Galea  had  little  basis  for  and  limited 
opportunity  to  modify  the  parameters  that  he  used. 


Data  Needs  and  Sources 

Any  simulation  depends  on  parameters  that  de¬ 
scribe  how  a  system  responds  to  some  event.  This  is 
true  whether  the  simulation  is  of  a  piece  of  steel  being 
bent,  or  a  human  passenger  escaping  an  aircraft  fire. 
The  simulation  can  never  be  any  better  than  the 
parameters  that  describe  the  system,  and  parameters 
that  characterize  human  response  can  be  some  of  the 
most  difficult  to  obtain.  All  cabin  evacuation  model¬ 
ing  efforts  (2,  3,  4,  5,  6)  have  identified  limitations  in 
the  sources  and  quality  of  data  upon  which  to  base 
modeling  parameters  as  a  primary  impediment  to  the 
accuracy  and  application  of  the  models. 

While  each  model  tends  to  have  unique  parameter 
needs,  there  are  a  number  of  parameter  needs  com¬ 
mon  to  all  models.  For  example,  the  GA  Model  (4) 
seeks  a  single  parameter  to  quantify  an  individual’s 
strength  and  ability  to  tolerate  fire  generated  toxins. 
The  GPSS  models  (2,3)  and  AIREVAC  (5)  have  no 
such  parameter,  in  part  because  they  are  not,  as 
developed,  suitable  for  accident  reconstruction.  In 
contrast,  all  models  (2-6)  depend  on  information 
about  flow  rates  in  aisles  and  through  exits. 

This  section  will  describe  some  of  the  parameters 
common  to  all  evacuation  models,  and  identify  exist¬ 
ing  sources  of  information  usable  as  a  basis  for  mod¬ 
eling  parameters.  The  reader  is  referred  to  the  work  of 
Schroeder  (17)  in  the  early  stages  of  the  development 
of  AIREVAC.  In  (17)  Schroeder  has  an  extensive 
literature  review,  including  his  conclusions  about  the 
applicability  to  cabin  evacuation  modeling  of  the  data 
in  the  references  he  found.  This  literature  review 
included  information  relevant  to  accident  reconstruc¬ 
tion  modeling  where  combustion  product  toxicology 
and  physiological  responses  are  important. 

Central  to  all  models  is  the  issue  of  passenger  flow 
rates,  and  all  models  need  information  about  how  fast 
people  move  in  aisles,  move  through  exits  and  onto 
slides,  and  how  quickly  people  will  move  from  a  row 
into  the  main  aisle.  Related  parameters  include  how 
long  it  takes  people  to  undo  their  seat  belt,  how  long 
to  begin  to  move  purposefully  towards  an  exit,  and 
how  long  it  takes  to  open  aircraft  exits  and  inflate 
slides.  It  can  be  assumed  that  through  much  of  the 
simulation  a  queue  (i.e.,  a  line)  will  exist  either  at  an 
exit,  or  at  some  other  point  in  the  cabin.  When  a 
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queue  exists,  the  model  must  simulate  the  behavior  of 
people  in  deciding  who  goes  first.  The  models  differ  in 
their  approaches  to  this  type  of  behavior.  While  the 
models  differ,  and  as  a  result  have  different  data  needs, 
there  are  common  data  needs  even  though  the  manner 
in  which  this  information  is  used  may  differ.  Param¬ 
eters  affecting  flow  rates  are  not  independent  of  pa¬ 
rameters  affecting  queuing.  If  a  slow  moving  passenger 
is  at  the  front  of  a  line,  no  one  in  that  line  can  move 
faster  than  that  slowest  passenger.  However,  if  a  faster 
passenger  who  is  behind  becomes  impatient,  and  has 
the  desire  and  physical  ability  to  cut  the  line,  that 
faster  passenger  can  get  out  before  the  slower  passen¬ 
ger- 

The  models  vary  in  how  they  simulate  strength, 
agility,  and  resistance  to  the  toxic  effects  of  smoke. 
Each  model  has  a  unique  approach  to  simulating  the 
cabin  environment,  ranging  from  AIREVAC  that 
cannot  simulate  an  environment  other  than  clear, 
clean  air,  to  EXODUS  that  can  be  run  with  a  very 
sophisticated  computational  fire  dynamics  model  to 
accurately  predict  the  combustion  product  toxins  in 
the  atmosphere  at  each  individual  location  in  the 
cabin,  and  how  much  of  the  toxins  are  absorbed  over 
time  as  a  passenger  moves  through  the  cabin. 

Research  at  CAMI  has  examined  many  aspects  of 
evacuation  performance  from  passenger  aircraft  (8, 
11-16).  The  Blethrow  report  (15)  is  particularly  use¬ 
ful  for  quantifying  the  agility  of  an  escaping  passen¬ 
ger,  and  how  this  agility  is  reduced  by  physical 
impairments  such  as  blindness,  obesity,  or  old  age. 
Data  relating  to  evacuation  rates  through  doors  and 
down  slides  may  also  be  obtained  from  airframe  man¬ 
ufacturer’s  research  (18-20).  All  of  the  evacuation 
models  allow  for  the  specification  of  passenger  age, 
gender,  and  indications  of  mobility  impairments. 
While  age  and  gender  are  stored,  there  is  no  direct 
relationship  in  any  of  the  models  between  these  fac¬ 
tors  and  the  passenger’s  speed,  agility,  or  endurance. 
Many  evacuation  studies  have  identified  gender  as  a 
factor  that  influences  a  passenger’s  speed  and  agility, 
but  there  are  no  widely  agreed  upon  factors  to  quan¬ 
tify  these  influences.  A  recent  evacuation  study  at 
CAMI,  in  which  age  was  a  controlled  variable  (21), 
found  that  a  younger  group  of  test  subjects  evacuated 
the  cabin  over  25%  faster  than  an  older  group  in  the 


same  cabin  configuration.  Other  factors  that  may 
influence  a  passenger’s  speed,  such  as  bonding  of 
husband  and  wife,  or  parent  and  child,  have  been 
identified  by  model  developers,  but  never  quantified. 

Data  for  use  in  quantifying  the  time  needed  by  a 
passenger  to  perceive  that  the  plane  has  stopped, 
unfasten  the  seat  belt,  get  out  of  the  seat,  and  begin  to 
move  purposefully  to  an  exit  are  not  generally  avail¬ 
able,  but  are  essential  parameters  for  any  simulation. 
Times  to  prepare  and  open  doors,  and  make  evacua¬ 
tion  slides  ready  for  use,  are  other  factors  not  generally 
available.  These  parameters  are  particularly  impor¬ 
tant  in  accident  reconstructions,  yet  are  virtually 
impossible  to  determine  from  accident  investigations. 
If  the  plane  is  on  fire,  who  is  going  to  time  how  long 
it  takes  to  get  the  door  open  rather  than  trying  to  assist 
in  the  rescue? 

Parameters  needed  to  model  the  toxic  effects  of 
smoke  and  heat  from  a  cabin  fire  are  difficult  to 
obtain.  A  complicating  factor  is  that  in  an  aircraft  fire, 
time  to  incapacitation  may  be  more  important  than  is 
time  to  death.  In  general,  incapacitation  occurs  long 
before  death  does,  but  death  is  likely  in  an  aircraft  fire 
if  a  passenger  is  incapacitated.  EXODUS  (6)  uses,  and 
AIREVAC  (17)  noted  for  future  application,  the  work 
of  Purser  (22)  in  defining  fractional  doses  of  typical 
aircraft  fire  toxins,  and  the  threat  to  life  that  these 
represent.  Using  data  from  a  detailed  computational 
fire  dynamics  model,  EXODUS  can  provide  a  very 
good  simulation  of  the  combustion  products  pre¬ 
sented  over  time  to  passengers  as  they  move  about  the 
cabin.  Computational  fire  dynamics  modeling  is  a 
very  sophisticated,  specialized,  and  complicated  sub¬ 
ject  far  beyond  the  scope  of  this  paper  to  discuss.  The 
interested  reader  is  referred  to  (6)  as  a  starting  point 
for  more  information. 

The  psycho-social  reaction  of  passengers  in  a  fire, 
for  use  in  an  accident  reconstruction,  may  differ  from 
the  behavior  seen  in  a  certification  test.  Muir  (10)  has 
studied  differences  in  cabin  evacuations  between  a 
certification  type  of  test,  and  evacuation  tests  in  which 
a  simulated  panic  occurred.  Schroeder  (17),  as  part  of 
his  work  developing  AIREVAC,  considered  how  to 
model  passenger  behavior  in  a  fire. 
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Validation  of  Models 

For  any  model  to  be  used  with  confidence,  the 
accuracy  of  the  mode!  must  be  validated.  Of  the 
models  discussed  in  this  paper,  validation  efforts  have 
ranged  from  matching  certification  tests,  as  was  done 
with  the  GPSS  models  developed  at  CAMI  in  the 
1970s,  to  accident  reconstructions,  as  attempted  by 
Gourary.  The  validation  work  of  Galea  with  EXO¬ 
DUS  (6)  may  be  the  most  extensive  including  an 
accident  reconstruction  (the  British  Airtours  Manches¬ 
ter  accident),  a  hypothetical  case  (a  wide  body  air¬ 
craft),  and  replicating  carefully  controlled  experimental 
evacuation  tests  run  by  Muir.  In  all  cases,  the  simula¬ 
tion  results  are  based  on  a  sample  of  runs  to  introduce 
the  inherent  variability  in  any  stochastic  process,  yet 
the  results  are  compared  to  a  single  test  (or  accident) 
from  an  equally  stochastic  process.  That  there  will  be 
some  variation  is  unavoidable.  The  general  conclu¬ 
sion  of  all  model  development  activities  has  been  that 
the  models  match  the  trends  seen  in  the  real  world, 
but  that  differences  do  exist.  These  differences  are 
generally  attributed  to  limited  information  for  use  in 
describing  the  system  to  the  model. 

Accident  reconstructions  are  a  more  formidable 
validation  exercise.  In  addition  to  the  variability  from 
being  a  stochastic  system,  there  are  a  great  many 
unknowns  in  an  accident.  Neglecting  details,  such  as 
how  the  fire  start?,  and  how  quickly  it  spreads,  it  is 
frequently  difficult  or  impossible  to  obtain  such  basic 
information  as  the  age,  gender,  weight,  physical  con¬ 
dition,  and/or  actual  seated  location  of  the  passengers 
in  the  plane.  Other  critical  information,  such  as  the 
time  for  door  opening  and  slide  inflation  is  even  more 
difficult  to  obtain.  Thus,  if  an  accident  reconstruction 
is  to  be  used  as  a  validation  basis,  one  cannot  expect  an 
exact  match.  General  trends,  such  as  the  location  and 
number  of  fatalities  demonstrates  the  accuracy  of  the 
model.  An  interesting  possibility  with  accident  recon¬ 
structions  is  to  study  the  influence  of  potential  design 
changes  (e.g.,  moving  the  location  of  an  exit,  or 
changing  the  type  of  exit  and  the  resulting  flow  rate) 
on  the  number  of  fatalities  resulting  from  the  acci¬ 
dent. 

Data  from  certification  type  tests  should  be  more 
easily  available,  have  more  available  information  (such 
as  complete  subject  descriptions  and  seating  loca¬ 


tions),  and  less  confounding  factors,  such  as  the  spread 
of  a  fire.  While  this  makes  them  more  suitable  in  the 
early  stages  of  a  validation  exercise,  it  also  means  that 
the  model  has  not  been  validated  to  study  real  or 
potentially  real  accident  situations.  Perhaps  the  best 
validation  exercise  would  be  a  set  of  carefully  con¬ 
trolled  evacuation  tests  with  only  a  few  experimental 
variables.  Validation  exercises  such  as  these  would 
include  detailed  information  for  use  in  the  develop¬ 
ment  of  a  model’s  parameter  data  set,  and  evaluation 
of  the  sensitivity  of  the  model’s  results  to  various 
parameters.  While  toxic  smoke  cannot  ethically  be 
introduced  into  a  cabin  full  of  people,  non-toxic 
theatrical  smoke  that  obscures  vision  can  be  used  in 
validation  exercises. 

Summary 

After  an  aircraft  accident  occurs,  quick  evacuation 
of  the  cabin  may  be  the  most  important  factor  influ¬ 
encing  survivability  of  the  accident.  The  FAA  has  a 
variety  of  regulations  regarding  training,  operation, 
and  design  of  aircraft  to  ensure  as  fast  a  cabin  evacu¬ 
ation  as  possible.  In  order  to  better  understand  factors 
that  influence  the  evacuation  process,  to  understand 
the  evacuation  process  in  accidents,  and  to  provide 
guidance  at  an  early  stage  in  the  design  cycle  of  new 
aircraft,  computerized  simulations  ofan  aircraft  cabin’s 
evacuation  have  been  studied. 

In  the  1970s  CAMI  developed  and  used  a  comput¬ 
erized  cabin  evacuation  model  that  required  a  large 
mainframe  computer,  and  whose  output  was  not 
easily  interpreted.  While  the  model  did  not  exactly 
match  certification  trials  of  some  current  aircraft,  the 
model  held  the  promise  that  if  all  necessary  param¬ 
eters  could  be  defined,  computerized  evacuation  mod¬ 
eling  could  become  a  powerful  tool  in  the  design  of 
safer  aircraft.  Today,  there  are  three  leading  models  in 
various  stages  of  development. 

In  the  mid-1980s  CAMI  sought  to  develop  a  new 
computer  model  that  could  run  on  an  inexpensive 
personal  computer  in  near  real  time,  that  would  pro¬ 
duce  an  easy-to-understand  visual  display,  and  that 
could  be  easily  modified  by  a  non-programmer.  The 
GA  Model,  developed  from  this  effort,  is  available 
today.  While  meeting  the  model  development’s  origi- 
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nal  goals,  the  model  is  limited  by  a  crude  cabin 
environment  model,  and  by  the  inability  to  simulate 
a  wide-body,  dual-aisle  aircraft. 

The  Air  Transport  Association  sponsored  the  de¬ 
velopment  of  a  cabin  evacuation  model,  principally  to 
assess  the  impact  on  evacuation  performance  of  carry¬ 
ing  mobility-impaired  passengers.  The  resulting  model, 
AIREVAC,  has  a  detailed  simulation  of  a  passenger’s 
psycho-social  responses  to  an  evacuation,  but  as  pres¬ 
ently  constructed,  it  can  only  represent  a  single  model 
of  an  aircraft,  and  cannot  simulate  a  fire  (i.e. ,  it  is  not 
suitable  for  accident  reconstruction,  but  only  for 
certification  tests). 

EXODUS  offers  the  ability  to  perform  detailed 
simulations  of  the  toxic  effects  of  an  aircraft  fire.  The 
simulation  has  already  been  used  successfully  to  simu¬ 
late  a  wide-body  aircraft,  a  series  of  evacuation  tests  at 
the  Cranfield  Institute,  and  to  reconstruct  the  1985 
Manchester,  England,  B-737  accident. 

All  models  depend  on  parameters  to  describe  the 
system  being  analyzed.  Most  evacuation  model  devel¬ 
opers  have  noted  the  limitations  on  sources  of  data 
upon  which  to  base  needed  parameter  values,  and 
attributed  limitations  in  the  accuracy  of  their  models 
to  these  shortcomings  in  the  available  data.  In  this 
paper,  many  of  the  available  sources  of  data  were 
identified,  and  an  even  more  complete  description 
may  be  found  in  Schroeder  (17).  In  the  future  when 
evacuation  tests  are  planned,  consideration  should  be 
given  to  obtaining  data  that  will  be  useful  in  the 
determination  of  modeling  parameters. 

The  validation  of  evacuation  models  can  be  based 
on  three  possible  sources.  The  most  challenging  is  to 
reconstruct  accidents.  Given  the  formidable  nature  of 
this  method,  exact  agreement  is  not  expected,  only  a 
general  agreement  in  the  location  and  number  of 
fatalities  can  be  expected.  Simulation  of  certification 
tests  is  simpler,  and  certification  tests  may  have  more 
information  available  for  the  modeler.  However,  the 
best  validation  exercises  will  be  evacuation  tests  de¬ 
signed  explicitly  to  serve  as  validation  tools  for  com¬ 
puter  models. 
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